Ensure that we don't mark weak heap references in the constant pool array.

src/heap.cc

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 5280 matching lines @@
   return EnsureDoubleAligned(this, object, size);
 }
 
 
 MaybeObject* Heap::AllocateConstantPoolArray(int number_of_int64_entries,
                                              int number_of_code_ptr_entries,
                                              int number_of_heap_ptr_entries,
                                              int number_of_int32_entries) {
   ASSERT(number_of_int64_entries > 0 || number_of_code_ptr_entries > 0 ||
          number_of_heap_ptr_entries > 0 || number_of_int32_entries > 0);
+
+  if (number_of_int64_entries < 0 ||
+      number_of_int64_entries > ConstantPoolArray::kMaxEntriesPerType ||
+      number_of_code_ptr_entries < 0 ||
+      number_of_code_ptr_entries > ConstantPoolArray::kMaxEntriesPerType ||
+      number_of_heap_ptr_entries < 0 ||
+      number_of_heap_ptr_entries > ConstantPoolArray::kMaxEntriesPerType ||
+      number_of_int32_entries < 0 ||
+      number_of_int32_entries > ConstantPoolArray::kMaxEntriesPerType) {
+    v8::internal::Heap::FatalProcessOutOfMemory("invalid array length", true);

[ulan, 2014/04/07 14:14:40]

Let's use ASSERT or CHECK instead of FatalProcessOutOfMemory because it is not
OOM.

[rmcilroy, 2014/04/07 14:23:12]

I was following what AllocateRawFixedArray does with FatalProcessOutOfMemory.  I
can change it to CHECK if you prefer (not ASSERT though since I want this to
happen in release too).

[ulan, 2014/04/07 14:52:01]

I would use CHECK in AllocateRawFixedArray too, but I see how it can be
connected to OOM: allocating a fixed array with kMaxLength elements (128M
elements) would likely cause OOM.

Here exceeding kMaxEntriesPerType (1K) is probably the result of a bug, and is
not related to OOM. So a simple CHECK seems more suitable.

[rmcilroy, 2014/04/07 20:19:17]

Sounds good - done.

+  }
   int size = ConstantPoolArray::SizeFor(number_of_int64_entries,
                                         number_of_code_ptr_entries,
                                         number_of_heap_ptr_entries,
                                         number_of_int32_entries);
 #ifndef V8_HOST_ARCH_64_BIT
   size += kPointerSize;
 #endif
   AllocationSpace space = SelectSpace(size, OLD_POINTER_SPACE, TENURED);
 
   HeapObject* object;
   { MaybeObject* maybe_object = AllocateRaw(size, space, OLD_POINTER_SPACE);
     if (!maybe_object->To<HeapObject>(&object)) return maybe_object;
   }
   object = EnsureDoubleAligned(this, object, size);
   HeapObject::cast(object)->set_map_no_write_barrier(constant_pool_array_map());
 
   ConstantPoolArray* constant_pool =
       reinterpret_cast<ConstantPoolArray*>(object);
-  constant_pool->SetEntryCounts(number_of_int64_entries,
-                                number_of_code_ptr_entries,
-                                number_of_heap_ptr_entries,
-                                number_of_int32_entries);
+  constant_pool->Init(number_of_int64_entries,
+                      number_of_code_ptr_entries,
+                      number_of_heap_ptr_entries,
+                      number_of_int32_entries);
   if (number_of_code_ptr_entries > 0) {
     int offset =
         constant_pool->OffsetOfElementAt(constant_pool->first_code_ptr_index());
     MemsetPointer(
         reinterpret_cast<Address*>(HeapObject::RawField(constant_pool, offset)),
         isolate()->builtins()->builtin(Builtins::kIllegal)->entry(),
         number_of_code_ptr_entries);
   }
   if (number_of_heap_ptr_entries > 0) {
     int offset =
         constant_pool->OffsetOfElementAt(constant_pool->first_heap_ptr_index());
     MemsetPointer(
         HeapObject::RawField(constant_pool, offset),
         undefined_value(),
         number_of_heap_ptr_entries);
   }
   return constant_pool;
 }
 
 
 MaybeObject* Heap::AllocateEmptyConstantPoolArray() {
   int size = ConstantPoolArray::SizeFor(0, 0, 0, 0);
   Object* result;
   { MaybeObject* maybe_result =
         AllocateRaw(size, OLD_DATA_SPACE, OLD_DATA_SPACE);
     if (!maybe_result->ToObject(&result)) return maybe_result;
   }
   HeapObject::cast(result)->set_map_no_write_barrier(constant_pool_array_map());
-  ConstantPoolArray::cast(result)->SetEntryCounts(0, 0, 0, 0);
+  ConstantPoolArray::cast(result)->Init(0, 0, 0, 0);
   return result;
 }
 
 
 MaybeObject* Heap::AllocateHashTable(int length, PretenureFlag pretenure) {
   Object* result;
   { MaybeObject* maybe_result = AllocateFixedArray(length, pretenure);
     if (!maybe_result->ToObject(&result)) return maybe_result;
   }
   reinterpret_cast<HeapObject*>(result)->set_map_no_write_barrier(
@@ skipping 2352 matching lines @@
       static_cast<int>(object_sizes_last_time_[index]));
   CODE_AGE_LIST_COMPLETE(ADJUST_LAST_TIME_OBJECT_COUNT)
 #undef ADJUST_LAST_TIME_OBJECT_COUNT
 
   OS::MemCopy(object_counts_last_time_, object_counts_, sizeof(object_counts_));
   OS::MemCopy(object_sizes_last_time_, object_sizes_, sizeof(object_sizes_));
   ClearObjectStats();
 }
 
 } }  // namespace v8::internal